Skip to content

IPv6 ACL support for DASH #222

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chrispsommers merged 4 commits into from
Sep 26, 2022
Merged

IPv6 ACL support for DASH #222

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
97271b1
IPv6 ACL support for DASH
mhanif Sep 13, 2022
d50df3e
Fix: No need to match against the ipv6 pkt type
mhanif Sep 14, 2022
1e4cfcb
Fixed few typos
mhanif Sep 20, 2022
684c366
Fixed IPv6 packet processing defects
mhanif Sep 20, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions dash-pipeline/bmv2/dash_acl.p4
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,9 +29,9 @@ match_kind {
table table_name { \
key = { \
meta. ## table_name ##_dash_acl_group_id : exact @name("meta.dash_acl_group_id:dash_acl_group_id"); \
hdr.ipv4.dst_addr : LIST_MATCH @name("hdr.ipv4.dst_addr:dip"); \
hdr.ipv4.src_addr : LIST_MATCH @name("hdr.ipv4.src_addr:sip"); \
hdr.ipv4.protocol : LIST_MATCH @name("hdr.ipv4.src_addr:protocol"); \
meta.dst_ip_addr : LIST_MATCH @name("meta.dst_ip_addr:dip"); \
meta.src_ip_addr : LIST_MATCH @name("meta.src_ip_addr:sip"); \
meta.ip_protocol : LIST_MATCH @name("meta.ip_protocol:protocol"); \
hdr.tcp.src_port : RANGE_LIST_MATCH @name("hdr.tcp.src_port:src_port"); \
hdr.tcp.dst_port : RANGE_LIST_MATCH @name("hdr.tcp.dst_port:dst_port"); \
} \
Expand Down
4 changes: 3 additions & 1 deletion dash-pipeline/bmv2/dash_metadata.p4
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,9 +42,11 @@ struct metadata_t {
eni_data_t eni_data;
bit<16> inbound_vm_id;
bit<8> appliance_id;
bit<1> is_dst_ip_v6;
bit<1> is_overlay_ip_v6;
bit<1> is_lkup_dst_ip_v6;
bit<8> ip_protocol;
IPv4ORv6Address dst_ip_addr;
IPv4ORv6Address src_ip_addr;
IPv4ORv6Address lkup_dst_ip_addr;
conntrack_data_t conntrack_data;
bit<16> stage1_dash_acl_group_id;
Expand Down
4 changes: 2 additions & 2 deletions dash-pipeline/bmv2/dash_outbound.p4
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ control outbound(inout headers_t hdr,
table routing {
key = {
meta.eni_id : exact @name("meta.eni_id:eni_id");
meta.is_dst_ip_v6 : exact @name("meta.is_dst_ip_v6:is_destination_v4_or_v6");
meta.is_overlay_ip_v6 : exact @name("meta.is_overlay_ip_v6:is_destination_v4_or_v6");
meta.dst_ip_addr : lpm @name("meta.dst_ip_addr:destination");
}

Expand Down Expand Up @@ -117,7 +117,7 @@ control outbound(inout headers_t hdr,
#endif // PNA_CONNTRACK

meta.lkup_dst_ip_addr = meta.dst_ip_addr;
meta.is_lkup_dst_ip_v6 = meta.is_dst_ip_v6;
meta.is_lkup_dst_ip_v6 = meta.is_overlay_ip_v6;

switch (routing.apply().action_run) {
route_vnet_direct:
Expand Down
16 changes: 11 additions & 5 deletions dash-pipeline/bmv2/dash_pipeline.p4
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ control dash_ingress(inout headers_t hdr,
meta.encap_data.vni = vm_vni;
meta.vnet_id = vnet_id;

if (meta.is_dst_ip_v6 == 1) {
if (meta.is_overlay_ip_v6 == 1) {
if (meta.direction == direction_t.OUTBOUND) {
ACL_GROUPS_COPY_TO_META(outbound_v6);
} else {
Expand Down Expand Up @@ -216,11 +216,11 @@ control dash_ingress(inout headers_t hdr,

action set_acl_group_attrs(bit<32> ip_addr_family) {
if (ip_addr_family == 0) /* SAI_IP_ADDR_FAMILY_IPV4 */ {
if (meta.is_dst_ip_v6 == 1) {
if (meta.is_overlay_ip_v6 == 1) {
meta.dropped = true;
}
} else {
if (meta.is_dst_ip_v6 == 0) {
if (meta.is_overlay_ip_v6 == 0) {
meta.dropped = true;
}
}
Expand Down Expand Up @@ -266,12 +266,18 @@ control dash_ingress(inout headers_t hdr,
}
}

meta.is_overlay_ip_v6 = 0;
meta.ip_protocol = 0;
meta.dst_ip_addr = 0;
meta.is_dst_ip_v6 = 0;
meta.src_ip_addr = 0;
if (hdr.ipv6.isValid()) {
meta.ip_protocol = hdr.ipv6.next_header;
meta.src_ip_addr = hdr.ipv6.src_addr;
meta.dst_ip_addr = hdr.ipv6.dst_addr;
meta.is_dst_ip_v6 = 1;
meta.is_overlay_ip_v6 = 1;
} else if (hdr.ipv4.isValid()) {
meta.ip_protocol = hdr.ipv4.protocol;
meta.src_ip_addr = (bit<128>)hdr.ipv4.src_addr;
meta.dst_ip_addr = (bit<128>)hdr.ipv4.dst_addr;
}

Expand Down